> Or you can just to the Network & Internet settings in Windows 10 and enable Metered> Connection

True, but that doesn't stop updates and upgrades from being needed by Windows, or prevent the device in question from potentially having a herpes-basket full of vulnerabilities.

Besides, the next time the setting gets turned off, you're back to square one because there isn't any real control over what can and can't be applied outside of a WSUS-managed update environment. Windows Update will just grab everything it sees that it needs and go to town - which will take longer than if it had just been updated inline as needed, and also increases the risk of toppling the system under the patch dependency load.